Vulnerability · Published Sep 28, 2026 · Assigned by Joomla

CVE-2026-101109Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8

Medium 5.3

In plain English

A medium-severity cross-site scripting in Vehicle Manager (Free) extension for Joomla from ordasoft.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.1%top 95.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page.

Affected products (as reported)

Vendor	Product	Versions
ordasoft.com	Vehicle Manager (Free) extension for Joomla	1.0.0-6.5.7

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://www.ordasoft.com/ product